The control that fails most often is a person who was told something convincing.

Three questions this answers

• Is this person who they say they are, before we hire them into a position of trust.
• Is this counterparty, founder or fund who they present as, before we invest or acquire.
• If somebody inside already meant us harm, would we know.

What the work is

Individual and persona due diligence

Open source work on a named individual or a presented identity, conducted lawfully and proportionately, and reported in a form that can be shown to a board or an investment committee. Where something cannot be established, the report says so rather than filling the gap with inference.

Insider threat

What an employee, contractor or partner can reach, what would be noticed, and how a departure is actually handled once notice is given.

Social engineering workshops and awareness

Run as a working session rather than a slide deck. People are shown how it is really done, including on them, and the point is not to catch anybody out. It is that the next call feels different.

The line this work does not cross

Everything is lawful, proportionate and documented. No pretexting of people who have not consented, no access to anything that is not open, and a written scope before anything begins. Due diligence that could embarrass you if it were disclosed is not due diligence, it is a liability.